For a long time, I thought that people would rise to the challenge and start effectively protecting their own privacy online, using tools and services that the market would provide. Many companies offered such services, and almost none of them succeeded (at least not with their original business plans). People simply weren't interested: They were both paranoid and careless, and took little trouble to inform themselves. (Of course, if you've ever attempted to read an online privacy statement, you'll understand why.)

But now I've simply changed my mind and realized that the whole question needs reframing - which Facebook et al. are in the process of doing. Users have never learned the power to say no to marketers who want their data...but they are getting into the habit of controlling it themselves because Facebook is teaching them that this is a natural thing to do.

Yes, Facebook certainly managed to draw attention to the whole "privacy" question with its Beacon tracking tool, but for most Facebook users the big question is how many people they can get to see their feed. They are happy to share their information with friends, and they consider it the most natural thing in the world to distinguish among friends (see new Facebook add-on applications such as Top Friends and Cliquey) and to manage their privacy settings to determine who can see which parts of their profile. So why shouldn't they do the same thing vis a vis marketers?

For example, I fly a lot, and I use various applications to let certain friends know where I am and plan to be. I'd be delighted to share that information with certain airlines and hotels if I knew they would send me special offers. (In fact, United Airlines once asked me to send in my frequent flyer statements from up to three competing airlines in exchange for 2000 bonus miles each. I gladly did so, and would have done it for free. I *want* United to know what a good customer I am...and how much more of my business they could win if they offered me even better deals.)

In short, for many users the Web is becoming a mirror, with users in control, rather than a heavily surveilled stage. The question isn't how to protect users' privacy, but rather how to give them better tools to control their own data - not by selling privacy or by getting them to "sell" their data, , but by feeding their natural fascination with themselves and allowing them to manage their own presence. What once seemed like an onerous, weird task becomes akin to self-grooming online.

This begs a lot of questions, I know, including real, coercive invasions of privacy by government agencies, but I think the in-control users of the future will be better equipped to fight back. Give them a little time and a few bad experiences, and they'll start to make the distinction between an airline selling seats and a government that simply won't allow you to take it off your buddy list.